Fluent Bit Tag Key Input Sanitization Vulnerability in Input Plugins

A vulnerability exists in the Fluent Bit input plugins for HTTP, Splunk, and Elasticsearch, all in version 4.1.0. These plugins do not properly sanitize tag_key inputs, allowing an attacker with network access or the ability to write records into Splunk or Elasticsearch to inject special characters, such as newlines or directory traversal sequences, into tag_key values. This injection can lead to newline injection, path traversal, forged record injection, or misrouting of logs, thereby compromising data integrity and log management.

Impact

Exploitation of this vulnerability could result in newline injection, path traversal, forged record injection, or misrouting of logs, all of which can disrupt data integrity and log management processes.